VENDOR RISK ASSESSMENT QUESTIONNAIRE FORM

1 VENDOR RISK ASSESSMENT QUESTIONNAIRE form . VENDOR NAME VENDOR ADDRESS. POINT OF CONTACT CONTACT INFORMATION. INSTRUCTIONS: Please complete this QUESTIONNAIRE in its entirety, leaving notes and attaching supporting documentation where necessary. Nature of Data VENDOR Will Have Access To check all that apply X DATA TYPE NOTES. No exchange of data Demographic data Financial Data Personal Data ( name, address, phone number). Non-public Personal Data ( SSN, medical, proprietary). Other: POLICIES AND PROCESSES. Yes No N/A QUESTION NOTES. Does your organization document, publish, and enforce security policies? Does your organization document and enforce HR policies? Does your organization document and enforce policies for authorized use of networked services?

2 POLICIES AND PROCESSES continued Yes No N/A QUESTION NOTES. Does your organization document and enforce policies for authorized use of company email, internet, and intranet? Does your organization document and enforce encryption policies and standards? Does your organization document and enforce policies regarding the storage, use, and disposal of sensitive data? Does your organization document and enforce policies regarding the storage, use, and disposal of sensitive data by third parties? Does your organization outsource functionalities related to security management? Do policies and procedures adhere to and comply with privacy laws and regulations related to the security, concealment, and safeguard of customer data?

3 Are the penalties associated with non- compliance to your organization's policies well documented? 2. physical AND DATA CENTER SECURITY MEASURES. Yes No N/A QUESTION NOTES. Does your organization regularly review and assess physical - and environmental-related risks ? Do data center perimeter controls involve the use of access cards? Do data center perimeter controls involve the use of keypad controls? Do data center perimeter controls involve the use of security guards? Do data center perimeter controls involve the use of __[add measure here]__? Do you have business continuity procedures in place if the office is inaccessible for any reason? Is all network equipment physically secured? Does your organization use data center providers?

4 Does your organization utilize visitor logs? If so, are they maintained for more than 30 days? Does your organization maintain a written policy regarding physical security requirements for the office? 3. MALWARE SECURITY MEASURES. Yes No N/A QUESTION NOTES. Are all emails scanned for viruses? Is anti-virus software required and enabled on all network computers? Does anti-virus software have an established frequency of scanning on network computers? Does your organization allow the installation of non-approved software on network computers? 4. INFORMATION SECURITY MEASURES. Yes No N/A QUESTION NOTES. Does your organization have an information security program in place? (please provide a link in the Notes column to all relevant public- facing security and privacy policies).

5 If your organization has an information security program, does it apply to all operations and systems that process sensitive data? Are relevant staff and managers professionally certified in information security? Is administrator-level access limited on network infrastructure? Are strict controls in place in order to access security logs? NETWORK INFRASTRUCTURE SECURITY MEASURES. Yes No N/A QUESTION NOTES. Does your organization maintain a network security policy ? Are all routers systematized with access control lists to stifle unauthorized traffic? Are server operating systems patched at the latest level? Does your organization have a process in place to track and communicate vulnerability patches?

6 Does your organization back up your data? Are backups stored and tested? Are employee devices encrypted? Is a third-party used to test network infrastructure security? Do you employ intrusion detection systems? 6. ADDITIONAL INFORMATION. RISK ASSESSOR NAME AND TITLE SIGNATURE DATE. 7. DISCLAIMER. Any articles, templates, or information provided by Smartsheet on the website are for reference only. While we strive to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the website or the information, articles, templates, or related graphics contained on the website.

7 Any reliance you place on such information is therefore strictly at your own risk.